Security and Governance Analyst

Michigan Virtual • Lansing, MI

2d • $69,246 - $77,393 • Hybrid

About The Position

The Security and Governance Analyst works within Technology Operations to maintain Michigan Virtual’s systems and data and help ensure technology—including AI and automation—is adopted securely, responsibly, and in compliance with organizational standards. The role spans day-to-day security operations and AI governance review, serving as a checkpoint for AI and automated solutions before release and throughout their lifecycle. The analyst works with the AI, Automation, & Governance Manager, the AI & Automation Specialist, the Managed Service Provider (MSP), and teams across the organization to keep security and governance practical and well-documented.

The role combines threat monitoring and response with risk assessment and clear documentation for non-technical audiences. Responsibilities include security monitoring and analysis, incident response, vulnerability management, compliance support, and intake and governance reviews for AI and automation requests. The analyst also supports training, documentation, communication of security risks and review outcomes, and professional development.

Michigan Virtual is a Lansing-based nonprofit 501(c)(3) organization dedicated to advancing education through research, innovation, policy, and digital learning solutions. It serves more than 300 full- and part-time employees and describes its culture as caring, collaborative, and supportive of professional growth and continuous learning. The position is hybrid under Michigan Virtual policy. Michigan residents receive hiring preference. The organization anticipated beginning the hiring process after the posting closed in mid-November and planned for a start date in early January.

Requirements

• Bachelor’s degree in information technology, cybersecurity, computer science, or a related field, or equivalent experience.
• Three or more years of experience in information security, IT compliance, risk, or a related field.
• A security certification such as Security+, CySA+, CCST, or similar is required.
• Hands-on experience in security operations, such as monitoring, log analysis, vulnerability management, and incident response.
• Working knowledge of security frameworks and controls, such as CIS Controls or NIST.
• Experience conducting risk, vendor, or compliance reviews and documenting findings and decisions.
• Working knowledge of data privacy, FERPA, and responsible technology use, including risks of AI tools.
• Familiarity with identity and access management concepts, such as role-based access, single sign-on, and least privilege.
• Strong judgment and ability to balance security and compliance with the needs of supported teams.
• Clear written and verbal communication skills, including explaining security and compliance topics to non-technical audiences.
• Ability to manage competing priorities.

Nice To Haves

• Experience with Microsoft 365, Entra ID, and endpoint management tools.

Responsibilities

• Monitor and advise on information security issues affecting internal systems and workflows, ensuring appropriate controls are in place.
• Review and analyze logs from IDS, firewalls, identity systems, and cloud services to identify threats and vulnerabilities, and implement corrective actions.
• Conduct security assessments of systems, workflows, and applications, and stay current on security issues, emerging threats, best practices, and trends.
• Support incident investigation, containment, documentation, resolution, and post-incident review.
• Work with the MSP to identify, triage, and escalate security incidents by reviewing alerts and monitoring data, assessing severity and scope, and coordinating containment and response actions.
• Maintain incident records and lessons learned, recommend improvements to response procedures, and provide end-user technical support for security-related issues.
• Perform vulnerability assessments; coordinate patching, removals, and updates with the MSP and IT teams; and track corrective actions to completion.
• Support implementation and maintenance of CIS Controls and other security initiatives.
• Conduct scheduled audits to maintain compliance with security policies, and document findings and remediation.
• Triage AI and automation requests and assess risk based on data sensitivity, system access, and impact.
• Conduct security, privacy, and vendor reviews of tools, automations, and new applications before adoption and periodically afterward, including data handling, access and permissions, vendor security, FERPA, and data privacy obligations.
• Review AI and automation solutions before production release and verify access controls and logging are in place.
• Help build and maintain the AI tool and automation inventory and supporting review records, including purpose, data sources, owners, vendors, risk assessments, and review dates.
• Support development and maintenance of AI governance policies, standards, and review procedures, and report on compliance, exceptions, and risks.
• Conduct user security training using existing training tools and contribute AI security and responsible-use guidance to staff training with the AI, Automation & Governance team.
• Collaborate with the MSP, leadership, and other teams to implement and uphold security practices and standards.
• Communicate security risks, review outcomes, and compliance status to the Manager and stakeholders.
• Maintain documentation of security systems and procedures, including knowledge base articles for security-related topics.
• Use Wrike to manage tasks, projects, and recurring security and review processes.
• Complete professional development opportunities that strengthen skills and benefit Michigan Virtual.

Benefits

• Professional growth and continuous learning opportunities.
• Reasonable accommodations for qualified individuals with disabilities during the application process and on the job.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level